code.gitea.io/gitea vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-20779Highcode.gitea.io/gitea: Gitea: TOTP TOCTOU race on web 2FA paths + missing replay check on Basic-Auth `X-Gitea-OTP` surfaceCVE-2026-58429Mediumcode.gitea.io/gitea: Gitea: Public-Only Personal access tokens scope bypass in Organization and Permission EndpointsCVE-2026-59765Mediumcode.gitea.io/gitea: Gitea: SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud MetadataCVE-2026-58511Lowcode.gitea.io/gitea: Gitea: Webhook Authorization Header Returned in Plaintext via APICVE-2026-57897Mediumcode.gitea.io/gitea: Gitea: Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIsCVE-2026-58510Mediumcode.gitea.io/gitea: Gitea: GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->privateCVE-2026-58422Highcode.gitea.io/gitea: Gitea: Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accountsCVE-2026-58419Highcode.gitea.io/gitea: Gitea: Notification API leaks private issue metadata after access revocationCVE-2026-25038Highcode.gitea.io/gitea: Gitea: Unauthorized Access to Labels of Private OrganizationsCVE-2026-27775Highcode.gitea.io/gitea: Gitea: Cached Per-Branch Permission Check in Pre-Receive Hook Allows Full Repository WriteCVE-2026-24451Highcode.gitea.io/gitea: Gitea: Fork Synchronization Continues After Parent Repository Changes from Public to PrivateCVE-2026-58314Highcode.gitea.io/gitea: Gitea: Two SSRF findingsCVE-2026-58436Highcode.gitea.io/gitea: Gitea: ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requestsCVE-2026-56657Mediumcode.gitea.io/gitea: Gitea SSH Key Parser Denial of ServiceCVE-2026-58437Highcode.gitea.io/gitea: Gitea: Repository Visibility Manipulation via Git Push OptionsCVE-2026-55987Highcode.gitea.io/gitea: Gitea: OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)CVE-2026-58435Mediumcode.gitea.io/gitea: Gitea LFS Deploy-Key Privilege EscalationCVE-2026-55984Lowcode.gitea.io/gitea: Gitea: Null Pointer Dereference in AddTime API Causes Authenticated Denial of ServiceCVE-2026-55982Mediumcode.gitea.io/gitea: Gitea: OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token ScopesCVE-2026-58434Lowcode.gitea.io/gitea: Gitea: Private Repository Metadata Remains Accessible After Access RevocationCVE-2026-54481Highcode.gitea.io/gitea: Gitea: Internal API HTTP client hardcodes InsecureSkipVerify:true with no config overrideCVE-2026-50105Mediumcode.gitea.io/gitea: Gitea: RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)CVE-2026-42931Mediumcode.gitea.io/gitea: Gitea: Denial of Service via Unbounded io.ReadAll in NPM Package Tag EndpointCVE-2026-58445Lowcode.gitea.io/gitea: Gitea: Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel APICVE-2026-58444Mediumcode.gitea.io/gitea: Gitea: Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository…

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo